Varonis Systems, Inc. (VRNS) Earnings Call Transcript & Summary

Great. Well, thank you guys so much. Good afternoon. Thank you for attending Citi's Global Tech Conference. My name is Mark Zhang, I support the team of Balani with Citi's software research coverage. And today, I have the pleasure of having Varonis here with us. To my left is David Gibson, SVP of Strategic Programs. And to his left, Guy Melamed, CFO and COO extraordinaire. So thank you guys for coming and all your time. Let's just jump right into it.

Maybe just a quick overview for those who aren't familiar with what you guys do and what's Varonis' mission. Can you just maybe give a quick summary on the state of the union, what you guys do, who you are and what your capabilities and solutions solve for?

Certainly. So Varonis sells software that protects data. We have a SaaS-based solution that helps people understand their data, meaning what's important, who's got access to it, who's using it, where is it at risk. And then we use automation to lock down the risks that we can see with that new visibility as well as monitor how it's being used, so we can detect threats to data and stop them automatically like an insider, like a Snowden or Teixeira, who was the insider with the Pentagon breach recently, or an external attacker like a ransomware or any other sophisticated attacker that may be after data.

Got you. Okay. Perfect. Now I guess it sounds -- obviously, you guys protect data, playing in cybersecurity space. But cybersecurity is a broad landscape and that's getting broader every day. Can you maybe help just frame exactly where you play in this cybersecurity space? What does your solution help maybe protect against? Who are the threat actors here, basically, target and protect your customers against?

Certainly. It's interesting. If you talk to any cybersecurity professional, of course, they would say, we protect data, if you ask them, like is protecting data important to you? But if you really think about the history of security, most of the technologies really didn't start with data, right? The metaphor was more about keeping the bad guys out, kind of starting with a firewall, a network base to kind of keep the bad guys from the Internet out or from the end point. And when you look at these traditional approaches that people have been trying to keep the bad guys out didn't start with data. So our approach has always been to focus on where the biggest concentrations of data live in an organization. And these days, they don't really live on an endpoint. They live in massive data stores, in data centers and in the cloud. And for the most part, the security technologies that have been adjacent to these haven't really directly interrogated these data stores in a way that we have. That's really where our approach differentiates, is to look inside these massive data sets to find what's important. So regulated data, sensitive information, information that might be financial records or credentials like passwords in clear text, right, or keys in clear text, like the kind that really exacerbated the Uber breach, and then see who can touch them. If you go to many organizations, and you ask them, show me all the data somebody can touch. It's a very hard mission, who can touch them, who's using them. And so it starts there with understanding that approach, right, of how is the data laid out and how is it protected. And from there, we can automate a lot of the remediation tasks like locking things down and then also use the same technology to make sure that people are using the data correctly.

Got you. No, that's great. And it's great that you actually mentioned a real-world experience, whether it's with Uber and other data breaches. But any other sort of examples you could maybe give a sense of a full chain of whether it's from an attack to, I guess, like remediation to how to basically get back to -- I guess like run state back -- I guess back to normalization?

Certainly. So when we start with organizations and we have some of these conversations about where do you store your critical data and how confident do you feel about how well it's protected, that usually leads to a risk assessment. This is a core part of our selling motion where we will light up our SaaS solution and map a data store for them or a couple of data stores. And invariably, what we see is what people kind of knew was probably true to begin with. Yes, there is -- way too many people have way too much access to data. And there are some surprises where sensitive data is stored, how people are using it. And if you think about the way attacks work today, there's a huge threat landscape. There's all sorts of endpoints. There's all sorts of cloud applications. There are just an innumerable amount of ways that an attacker could get in. And it's almost impossible to tell where an attack is going to come from, but you know where it's going. It's always going to the data, right? So really getting a handle on the data, what happens if an end point misses something? What happens if you have a vulnerable server? What happens if you have an insider like a Snowden? What's going to protect you then? Our risk assessments light up that kind of situation and illustrate how we can get back to that state you mentioned. We now have a blueprint. Once we do this risk assessment, here are the highest concentrations of sensitive data that are most exposed. And you don't have to live with that. Our automation automatically addresses these risks. And that's one of the things that's really appealing about our platform, is the amount of results, the amount of outcomes you get without effort, because a lot of security teams are stretched pretty thin these days.

All right, all right. That sounds like a unique offering and very competitive in the market. So maybe if I am a security analyst today, if I don't use Varonis, what are my alternative options? What else are you...

Sure. So -- and let's broaden it from just the security analyst. I can talk about that specific use case too, but the security teams, it's not like they're not trying to secure data, to lock down data. Nobody would say that they're not trying. It's just that the amount of risks that are being generated every day are almost immeasurable and certainly irreparable manually. With cloud repositories today, I don't know how many people here use Teams or Microsoft 365 or Box or Google Drive. These platforms have made so easy for end users to collaborate without any help or any guidance from IT. I think of it as a party with no parents home, right? There's just chaos happening in the time that we've had this conversation. There's been more risk generated by end users than we could count, right? So the idea that you can address some of these risks without specific automation that was built for it has just become kind of a nonstarter for folks. So people have started with native technologies, point solutions, other security technologies that eat around the problem, but don't address it head on.

Got you. And then to that point, can you maybe give us a sense of what the competitive landscape looks like, who you compete against? How do you differentiate yourself when it comes to maybe a platform vendor like a Microsoft? Obviously, Microsoft is this 300-pound gorilla or 800-pound gorilla that is spanning everyone. Do you guys see sort of a threat from them as well? And how do you sort of differentiate yourself from this?

Well, we're a Microsoft partner, and we have actually a great synergy with Microsoft now. One of the ways that people are trying to protect data is to try to prevent sensitive data from being e-mailed out or being saved to a USB key or being printed. And for that, Microsoft has a nice technology called Purview Information Protection. And the idea is that you put labels on these files that shouldn't be printed or shouldn't be sent, right, or should be encrypted. And that happens automatically, and that provides a layer of protection. With Varonis, people are able to actually get the right labels on the right files far more quickly without even requiring users to put a label on the files at all. And so that helps the story that kind of -- it's a better together story there. So more and more, I think as our platform has matured and as the ecosystem has developed, our place in it is becoming clearer and how we help with other technologies like Microsoft is becoming clearer.

Got you. Okay. No, that's great. And now the platform is maturing and you guys actually recently started to talk more about your new model transition to SaaS. Maybe we'll get Guy more involved here as well. But maybe can you give us a sense of what does transition entails, what kind of modes of delivery you've had, and what, I guess, like essentially if net new, would assess model transition?

So I think start from the important part, SaaS is a better product. And we're getting a lot of positive reactions from our customers on how the product is so much better. And we're getting very positive reaction from our sales force. So that's been a very, very interesting kind of -- as we track through the transition, and we're very early in it, this is only our third quarter, we feel very good about where we are. When we talked about kind of the time frame for the transition, we talked about a 5-year period. We talked about Phase 1, where we target new customers, selling them SaaS. And then we expected that to be anywhere between 1 to 2 years. And then as we get close to ending that part, we would start targeting Phase 2, which is converting our existing customers from self-hosted to SaaS. And we talked about Phase 2 being anywhere between 3 to 4 years. So the aggregate transition expected to be 5 years, and we defined a transition to be complete when we have anywhere between 70% to 90% of our ARR coming from SaaS. Now what's great is that at the end of Q2, we already reached about approximately 10% of our ARR coming from SaaS, which is great progress for us. And we talked about the fact that at the end of the year, we will have to reevaluate our time frame. Because what's actually happening is that Phase 2, our existing customers, in a very natural way, are requesting to convert to SaaS. Our reps make money on anything they get on top of the renewal. So it works for them; it works for our customers. As I said before, it's a better product. So it's a win-win for us, win-win for everyone.

Got you. You say it's a better product, but can you maybe give us a sense of why that SaaS product is different or better from the previous version for customers? Does it drive just greater adoption, just greater sales motion? I mean you mentioned a greater sales motion, but anything else that we should keep in mind as you're going through this transition?

So several elements. The first element is that in this environment where so many -- the threat landscape is evolving by the minute. Your ability to provide updates and upgrades in an instantaneous way through SaaS is something you can't do through your on-prem subscription offering. So Log4j, which was one of the biggest breaches that took place last year, you had to go to every single customer and make sure that they downloaded the update and that they installed it. And that's a process that is tedious to the customer and tedious for our sales organization. With the SaaS offering, you find an attack in one part of the globe, and you can make sure that all of your customers are protected within minutes as you distribute it to your entire customer base. So the time to install the product is shorter. The value that customers get is much higher. And the automation as part of the SaaS is much, much greater.

Got you. Okay. No, that makes sense. And I guess like through the SaaS transition and even from the beginning, do we need to see more investments from you guys, whether from a sales force capacity standpoint or from a capability standpoint that needed to be done to facilitate this transition?

So first of all, our -- the vast majority of our sales force are embracing this transition and this is very different than what we saw in 2019 when we moved from perpetual to on-prem subscription, and we saw some resistance. We're not seeing any resistance in this transition. And part of it is because it's so much simpler to sell it and it's so much easier to provide value to customers. When we look at our sales force, the one thing that we feel very good about is our ability to extract more dollars from customers through the SaaS offering. So the customer lifetime value can increase because we're selling the platform, we're providing the automation. And with that automation, the customer satisfaction goes up and their desire to protect additional platforms increases. So they will come back and buy more. And that works well in showing that value. One of the things that we changed with the SaaS offering is doubled down on consolidation of SKUs, which means that we had bundles when we offered in 2022 through our on-prem subscription. We had gold, silver and platinum bundles. We saw that that worked very well with simplification to our sales force and simplification for our customers. So when we introduce SaaS, we consolidated SKUs into 1 SKU and now we're selling the platform. And that's been received very well by sales force and customers.

Got you. And I guess, given our state of the economy and the macro headwinds, have you seen any impact from macro on your transition to SaaS?

When we gave guidance at the beginning of the year, we took into consideration macroeconomical deterioration. I can say that in Q2, it was very similar in terms of macro to Q1. So we didn't see that deterioration. Our guidance for the second part of the year does assume deterioration, even though we didn't see it in Q2. We -- when we built the guidance, there were 2 factors. It was the macro component that we just talked about and the fact that we will go through a transition. And every time you go through a transition, there's this -- usually the first 6 months of the transition are the most challenging part where your reps are trying to clean through the pipeline, which was originally introduced as on-premise subscription, but now they're trying to sell SaaS. So they're introducing another concept to a deal in flight and that generates some turbulence. With our sales cycles being 3 to 9 months and up to 12 months on the larger deals, the vast majority of that pipeline has been cleaned. And that's why it kind of feels that we're past the challenging part of the transition. Still a lot of things to do, and we want to make sure that we can provide a lot of value to our customers. But at least from introducing quotes that have been originally introduced as on-prem subscription, we're through the vast majority of that.

Got you. And I guess, once you're completely through the SaaS transition, does this change your competitive positioning in cybersecurity at all? Does it change sort of your value that you -- changes the value that you bring to your customers? But does this also open up your competitive landscape?

So I think it's widened our moat. The advances that we've made in our SaaS technology, in many ways, it's now light-years ahead of our self-hosted offering; the automated value, the kind of robotic value proposition that we now offer, where we really are allowing customers to define the rules of the road, what should be permitted, and then we automatically enforce the rules of the road. So people don't have access to data that they shouldn't have or no longer need without them having to go through the manual effort of cleanup. These kinds of values across such a wide array of data platforms is enormous value. And then if you couple that with an offering that we call Proactive Incident Response, where we're able to be a set of eyes on glass, we're able to watch the alerts on behalf of our customers, do some initial triage and investigation, and give them a call if we think there's a threat that they really need to know about that kind of no-touch value has been very well received as well and I believe widens the gap between us and anybody that would be nipping or trying to nip at our heels.

Got you. No, that makes sense. Maybe just on the financial impact of the transition. From our understanding, the revenue recognition for SaaS is different from your prior model. Can you describe how it works and what's changed? And what's the sort of KPIs that we should look forward to?

So over the last I'd say, 1.5 years, we've talked about ARR being the leading indicator for us. And it especially is the case during a transition, because the way revenue is recognized in SaaS, it's ratable. And with the on-prem subscription, we would recognize 80% of the deal when we ship the license and then 20% over the term of the deal, which was over a 1-year period usually. That's why revenue is a lagging indicator during the transition. And when we did our Investor Day in March, we talked about the 3 North Stars: ARR, free cash flow and ARR contribution margins. Those are the indicators that will allow investors to identify the health of the business. When you look at the ARR, the revenue recognition can change, but the ARR is the same amount. So that's why it becomes the leading indicator. Free cash flow. We've increased our free cash flow projections significantly in the last earnings call and raised it from $20 million, $25 million to $40 million, $45 million for the year. We're very much focused on increasing our free cash flow generation, and I think we're very well positioned to do that. And when you look at the ARR contribution margin, which is ARR minus non-GAAP operating expenses, you can see that we have started to show leverage even in the initiation of the transition, which is -- it's not that simple to do. So I think in terms of the cost structure, we kept it very much intact even with the investments that we had to make and are very focused on those 3 KPIs.

Got you. It's interesting, you mentioned free cash flow, margins, ARR contribution, but you left out operating margins and operating income. Is there a reason why operating income isn't a good indicator?

So the only thing in terms of the operating -- the problem with the operating margin is that it takes into consideration revenue. So when revenue is a lagging indicator, and if you try to -- you're going to see headwind the quicker the transition takes place. So let's take Q2 as an example, we saw more conversions take place in Q2. We called it out in Q1 in terms of increased pipeline. We didn't see it happen yet in Q1, but we called it out that the pipeline is increasing. And if customers do convert, there will be pressure on revenues and operating margin. But we see that as a good thing. So -- and that's exactly what happened in Q2. Revenue was lower than expected, but we were very happy with the results. And the operating margins are impacted by the revenue. And that's why we looked at ARR contribution margin as kind of the right way to look at things.

Got you. And then just maybe delving a little bit into the recent performance as you're going through a transition, you guys have clearly outperformed on the ARR aspect and also the transition mix percentage. But we haven't seen maybe as strong of an uplift on your full year guidance as your mix or adoption rate may suggest. So maybe can you square the new and upsell mix, which is now expected to be 50% versus 35% previously and I guess, like maybe a little bit more prudent on the ARR guide? Is that more so caution on your part? And if there's any other just delta we should keep in mind?

So first of all, we increased our ARR full year guidance by $8 million, which was -- for us, it was more than what we expected to do in Q2. I think we felt very good with the results that we came up with. But our -- we take the numbers that we give the Street very seriously. So we kept the same philosophy where we give out numbers and we want to make sure that we can achieve against those numbers. We increased our free cash flow pretty significantly as well. As you mentioned, the SaaS mix went up pretty significantly as well, and we expect 45% in Q3 and expect 50% in Q4. So when we look at where we are today, we're in a much better position today than we were when we just introduced the SaaS offering, and we feel that we're very well positioned for the second part of the year.

Got you. Okay. And then just in terms of the transition between Phase 1, Phase 2, obviously, we're still in Phase 1. But any sense of what inning are we in through this transition? When should we start -- I guess, like you've mentioned the 1 to 2 years. But given your strong results of customer adoption, is there any sense of there's a pull forward of the time line? Anything in terms of just like upside to the transition pace?

So I'd say that the feedback that we've been getting with investors -- from investors has been that everyone is very surprised that we got the 10% of SaaS out of ARR at the end of Q2. And when you look at our -- look at kind of completing a transition, we define that, as I said previously, as being anywhere between 70% to 90%, and we just started. In the last earnings call, we talked about the fact that we will revisit the time line at the end of the year because it is happening quicker. But I can say that overall, we've been very happy with the progression and the adoption and the fact that we're providing more value to customers.

Got you. And then just on the time line for Phase 2, it seems obviously longer than Phase 1. Any sort of specific details to call out now that you're in Phase 2, going into your existing customers and transitioning them to SaaS? When does that maybe take longer? Should the existing customers see the value that SaaS brings and shouldn't that transition be faster?

Well, they see the value, and that's why they're coming to us and asking to convert. But you have to remember that when we sell on-prem subscription, we sell up to 3-year deals. So you'd still have customers that bought on-prem subscription and that they would wait for that 3 years to go by in order to convert. We've definitely seen customers that come to us before the 3-year period and want to switch prior. But some of them would just wait because they have the allocated hardware, and they did that investment. And that's part of the reason that Phase 2 is longer than Phase 1.

Got you. And are you seeing any potential pushback from existing customers that want to stay on-prem? And how do you address sort of the reluctance to go to SaaS, even though there's a lot of value there?

No. It's -- there's not really any objection per se. It's a better product, as Guy said, and it's easier to install, it's easier to maintain. The upgrades aren't there, and you get more value more quickly. So they're not really any like functional objections that I feel like we need to overcome. We have talked a little bit about some of the feature parity. But as I mentioned, SaaS, in most respects, is ahead of the self-hosted, so...

Got you. Okay. Okay. And then I guess like now that we're 4 or 5 years down the line into the transition, 75% -- you've you achieved 75%, it's 90% SaaS. What does Varonis look like from a financial standpoint, from a go-to-market standpoint, from just your mission standpoint?

So we laid out during the Investor Day kind of the 5-year plan. And we talked about our desire to get to $1 billion of ARR by 2027, which is -- kind of coincides with the 5-year transition. We also talked about ARR contribution margin being, when we get to 2027, to be 20%. And I think when you look at kind of the leverage that we have in the model, as we transition to SaaS, there's a lot of benefits that we can gain, whether it's maintaining only one type of code through the R&D department. And instead of having R&D that is high 20s percentage out of ARR, it can come down to, let's say, approximately 20%. So there's a lot of leverage coming out of there. There's leverage in the support and professional service department. And there's leverage in the sales and marketing department selling SaaS, just because of the way you sell as in comparison to on-prem subscription. So I think that, as we laid out kind of the framework for this transition, we believe that this company can completely change the offering that we have to provide and the value that we provide to customers through the SaaS offering. And that will allow us to generate more leverage, more free cash flow and increase our ARR contribution margin.

Got you. Yes, that sounds terrific. It seems like the demand is there. And I think to your point, there's existing customers asking you guys for SaaS today. So why not roll out, I guess, like Phase 1, Phase 2 together? Why focus more on Phase 1 first, selling new and then moving on to the existing? Is it just more so friction in the sales motion, confusion on the customer side? Just -- why not just flood doors open, open it up to existing as well currently?

This is -- this has to be a more measured transition, because there's costs associated with SaaS, you have to make sure that everything is working properly. You have to make sure that you're providing value to customers the way we have provided value in the past. So this is not a perpetual to on-prem subscription transition that in 5 quarters, you go from less than 5% on-prem subscription to 99%. We talked about the fact that this won't be at the same pace. But yet again, we're still very happy that it's happening quicker than we initially anticipated. And as we kind of enter the second part of the year, we'll see how Q3 and Q4 progress. We've already baked into our guidance an $8 million conversion in Q3 and $10 million conversion in Q4. So that's already a much larger number than we initially anticipated when we started the year. And that's happening in a natural way, which is great. So we're not in Phase 2 yet, but we're seeing it happen in a natural way so far.

Got you. Yes. No, that's terrific to hear. And we certainly like to see ARR [ beaten and few misses ]. So maybe just moving beyond the SaaS transition. Just on, I guess, like the other pieces of your business, especially federal. Federal seems like a very large opportunity for you guys. What are sort of the hurdles that you need to maybe clear before you start seeing more federal opportunities come to fruition? I know obviously, there's FedRAMP that you may need to achieve. So in terms of time line of achieving FedRAMP, and what the opportunity could look like once you have...

So let's talk about FedRAMP first. We talked about the fact that in Q3, where federal waited in terms of the quarter, that's part of the reason that the SaaS mix is coming down, because we expect federal sales to be a headwind to the SaaS mix. We're investing a lot of time, money and resources in order to get FedRAMP, and we hope to be ready for the next year's cycle. We have a great federal team. We've been investing in order to build the business there. Our federal business as of now is mid-single-digit percentage out of ARR, so there's a lot of room to grow. The offering is there. Federal customers need the product, that's very obvious, when you look at all the breaches that have taken place in that space. And we need to get to the right people within the organization. We have the right team in place. It just takes time. And that's -- we'll obviously give updates at the end of this quarter, because the end of September is the end of the cycle for the federal budget cycle. So we'll update at the end of this quarter.

Sure. So maybe to -- I guess, frame the federal opportunity, who is serving, I guess, like that federal space today? Are they using a Varonis -- like a substitute that you could go in and look to displace? Or is this net new dollars from the federal budgets that you would like to capture?

I think when we go in and do a risk assessment with no matter who it is and what area of government it is, we generally see the same issues that we see in other organizations where there's sensitive data in places that are surprising, and far more people have access to it. And if you ask somebody to tell you, show me all the sensitive data that -- to share access over the past 90 days, that would be hard. So I think that there's -- without us, there are these gaps that are very tough to solve. I mean if you look at the Pentagon breach, they did everything right at the perimeter, right? Teixeira worked in a secure computing information facility, a skiff, which is essentially like a trailer that has no RF going out of it, right? You're not bringing any devices in or out, right? It's the most perimeter defense that you can possibly have. But still what happened? You had far more access to data than probably should have and not enough beeps when there was this kind of excessive access as would be necessary to stop the breach.

Got you. No, that makes sense. So there's about 3 minutes left. I wanted to field the audience for any questions before we wrap up, otherwise...

Now that you have SaaS products, have you been able to reach new customers that you weren't able to reach before?

The answer is yes. There's been a lot of customers that want to use the SaaS offering. And it opens a whole new avenue, a whole new greenfield opportunity of customers that we couldn't target before. And now through SaaS, we can target them.

Great. And then maybe just a quick check-in on DA Cloud. How has that -- maybe the success so far and SaaS translate over to DA Cloud? I understand that piece is still small. But what's the transactions there -- traction there and the expectations going forward?

So we're looking at Varonis' SaaS as one big component. We're not breaking out Varonis' SaaS versus DA Cloud. The one thing that we've talked a lot about is that it takes time for new products to kind of gain traction. And we've seen that with the Office 365 and the automation engine until kind of the reps feel comfortable selling it. It allows us to go wider and deeper. And it's an offering that we believe can generate a lot of traction with our existing customers and new customers.

Got you. Okay. We have about 1 minute left. Would definitely want to leave some time for David and Guy to maybe make their final statement to the audience. What's the 1 or 2 key messages you guys want everyone to take away from Varonis...

I'd say that it's an exciting time. Varonis is going through a transition that allows customers to be better protected, and there's a lot of benefits for us as an organization while we do so. So ARR, free cash flow and ARR contribution margins are the 3 KPIs, they're the North Stars through the transition to check the health of the business. We've tried to be very transparent with the amount of information that we provide, so investors and analysts can track through the transition, and that's why we gave kind of the SaaS mix being approximately 10% out of our ARR at the end of Q2. So I think that what I would like to end with is that we are in a very interesting position. The offering that we have today can provide a lot of value to our customers. And we hope to do -- to continue to execute in the quarters ahead.

Yes. Okay. David, any last words? 20 seconds on the shot clock...

What he said.

Perfect. All right. I think that does it for the session. Thank you guys so much for attending, and enjoy the rest of the conference.